Add ToObject call in Array.prototype.sort

src/array.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var $arrayConcat;
 var $arrayPush;
 var $arrayPop;
 var $arrayShift;
 var $arraySlice;
 var $arraySplice;
@@ skipping 1158 matching lines @@
     ShadowPrototypeElements(this, num_non_undefined, max_prototype_element);
   }
 
   return this;
 }
 
 
 function ArraySort(comparefn) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.sort");
 
-  var length = TO_UINT32(this.length);
-  return %_CallFunction(this, length, comparefn, InnerArraySort);
+  var array = $toObject(this);
+  var length = TO_UINT32(array.length);
+  return %_CallFunction(array, length, comparefn, InnerArraySort);
 }
 
 
 // The following functions cannot be made efficient on sparse arrays while
 // preserving the semantics, since the calls to the receiver function can add
 // or delete elements from the array.
 function InnerArrayFilter(f, receiver, array, length) {
   if (!IS_SPEC_FUNCTION(f)) throw MakeTypeError(kCalledNonCallable, f);
   var needs_wrapper = false;
   if (IS_NULL(receiver)) {
@@ skipping 503 matching lines @@
 
 $arrayConcat = ArrayConcatJS;
 $arrayPush = ArrayPush;
 $arrayPop = ArrayPop;
 $arrayShift = ArrayShift;
 $arraySlice = ArraySlice;
 $arraySplice = ArraySplice;
 $arrayUnshift = ArrayUnshift;
 
 });